#include "mail_type.h"

#define IS_MOVE_WEBMAIL 1

Mail_info *find_mail_node(unsigned long source_ip, unsigned long dest_ip, unsigned short source_port, unsigned short dest_port, int *is_sent)
{
	//printf("find_mail_node ...\n");
	Mail_info *mail_info = mail_tab.head->next;
	while (mail_info != NULL) 
	{
		if (mail_info->source_ip == source_ip && mail_info->dest_ip == dest_ip && mail_info->source_port == source_port && mail_info->dest_port == dest_port && !mail_info->is_complished) 
		{
			*is_sent = 1;
			//printf("find_mail_node *is_sent = 1 ...\n");
			break;
		}
		else
		if (mail_info->source_ip == dest_ip && mail_info->dest_ip == source_ip && mail_info->source_port == dest_port && mail_info->dest_port == source_port && !mail_info->is_complished) 
		{
			*is_sent = 0;
			//printf("find_mail_node *is_sent = 0 ...\n");
			break;
		}
		else
		{
			mail_info = mail_info->next;
		}
	}
	//printf("find_mail_node complete ...\n");
	return mail_info;
}

Attach_info *find_attach_node(unsigned long source_ip, unsigned long dest_ip, unsigned short source_port, unsigned short dest_port, int *is_sent, unsigned short packet_type)
{
	//printf("find_attach_node ...\n");
	Attach_info *attach_info = attach_tab.head->next;
	while (attach_info != NULL) 
	{
		if (attach_info->source_ip == source_ip && attach_info->dest_ip == dest_ip && attach_info->source_port == source_port && attach_info->dest_port == dest_port && !attach_info->is_complished && (attach_info->packet_type == packet_type||packet_type <=0)) 
		{
			*is_sent = 1;
			break;
		} 
		else 
		if (attach_info->source_ip == dest_ip && attach_info->dest_ip == source_ip && attach_info->source_port == dest_port && attach_info->dest_port == source_port && !attach_info->is_complished && (attach_info->packet_type == packet_type||packet_type <=0)) 
		{
			*is_sent = 0;
			break;
		} 
		else 
		{
			attach_info = attach_info->next;
		}
	}

	//printf("find_attach_node complete ...\n");
	if(attach_info) 
//printf("find attach-%p\n",attach_info);
	return attach_info;
}

Mail_info *insert_mail_node(char *srcMAC, struct iphdr *pip, struct tcphdr *ptcp, unsigned short type)
{
	//printf("insert_mail_node...");
	Mail_info *mail_info = (Mail_info *)malloc(sizeof(Mail_info));
	if (mail_info == NULL)
		return NULL;
	
	memset(mail_info, 0, sizeof(Mail_info));
	mail_info->source_ip = pip->saddr;
	mail_info->dest_ip = pip->daddr;
	mail_info->source_port = ptcp->source;
	mail_info->dest_port = ptcp->dest;
	memcpy(mail_info->client_mac, srcMAC, MAC_LEN);
	mail_info->is_complished = 0;
	mail_info->mail_type = type;
	mail_info->mail_length = 0;
	mail_info->ok_length = 0;//
	mail_info->mail_data = NULL;
	mail_info->is_writing = 0;
	mail_info->recive_length = 0;
	mail_info->recive_data = NULL;
	mail_info->connect_id[0]=0;
	mail_info->mail_id = (char *)malloc(MAX_ID_LEN);
	memset(mail_info->mail_id, 0, MAX_ID_LEN);
	mail_info->is_proce_mail = 0;
	mail_info->content = NULL;
	mail_info->attach = NULL;
	mail_info->num_of_attach = 0;
	mail_info->start_seq = ntohl(ptcp->seq);
	mail_info->prev = mail_tab.head;
	mail_info->next = mail_tab.head->next;
	mail_tab.head->next = mail_info;
	int tmp_type;
	tmp_type=type>>8;
	//printf("type : %d\n", tmp_type);
	switch(tmp_type)
	{
		case 1: mail_info->mail_num= 306; strcpy(mail_info->url, "mail.sina.com"); break;
		case 2: mail_info->mail_num= 307; strcpy(mail_info->url, "mail.21cn.com"); break;
		case 3: mail_info->mail_num= 305; strcpy(mail_info->url, "mail.sohu.com"); break;
		case 4: mail_info->mail_num= 301; strcpy(mail_info->url, "mail.163.com"); break;
		case 5: mail_info->mail_num= 303; strcpy(mail_info->url, "www.hotmail.com"); break;
		case 6: mail_info->mail_num= 304; strcpy(mail_info->url, "mail.yahoo.com"); break;
		case 7: mail_info->mail_num= 302; strcpy(mail_info->url, "mail.tom.com"); break;
		case 8: mail_info->mail_num= 301; strcpy(mail_info->url, "mail.yeah.net"); break;
		case 9: mail_info->mail_num= 309; strcpy(mail_info->url, "www.eyou.com"); break;
		case 10:mail_info->mail_num= 309; strcpy(mail_info->url, "mail.236.com"); break;
		case 11:mail_info->mail_num= 308; strcpy(mail_info->url, "mail.qq.com"); break;
		case 12:mail_info->mail_num= 305; strcpy(mail_info->url, "mail.sogou.com"); break;
		case 13:mail_info->mail_num= 301; strcpy(mail_info->url, "mail.126.com"); break;
		case 14:mail_info->mail_num= 301; strcpy(mail_info->url, "mail.188.com"); break;
		case 15:mail_info->mail_num= 310; strcpy(mail_info->url, "www.gmail.com"); break;
		case 16:mail_info->mail_num= 311; strcpy(mail_info->url, "www.mail.com");break;
		case 17:mail_info->mail_num= 312; strcpy(mail_info->url, "mail.aol.com");break;
		case 18:mail_info->mail_num= 313; strcpy(mail_info->url, "mail.daum.net");break;
		case 19:mail_info->mail_num= 314; strcpy(mail_info->url, "mail.139.com");break;
		//手机webmail
		case 129:mail_info->mail_num= 301; strcpy(mail_info->url, "mail.163.com");break;
		case 130:mail_info->mail_num= 302; strcpy(mail_info->url, "mail.qq.com");break;
	  	default: break;
	}
	mail_tab.count++;
	if (mail_info->next != NULL)
		mail_info->next->prev = mail_info;

	//printf("insert_mail_node complete ...\n");
	
	return mail_info;
}

Attach_info *insert_attach_node(struct iphdr *pip, struct tcphdr *ptcp, unsigned short type, unsigned short packet_type)
{
	//printf("insert_attach_node ...\n");
	if(attach_tab.count == 20){
		Attach_info *attach_tmp = attach_tab.tail;
		attach_tab.tail->prev->next=NULL;
		attach_tab.tail=attach_tab.tail->prev;
		delete_attach(attach_tmp);
		attach_tab.count--;
	}

	Attach_info *attach_info = (Attach_info *)malloc(sizeof(Attach_info));
	if (attach_info == NULL)
		return NULL;

	memset(attach_info,0,sizeof(Attach_info));
	attach_info->packet_type = packet_type;
	attach_info->source_ip = pip->saddr;
	attach_info->dest_ip = pip->daddr;
	attach_info->source_port = ptcp->source;
	attach_info->dest_port = ptcp->dest;
	attach_info->attach_type = type;
	attach_info->is_complished = 0;
	attach_info->is_writing = 0;
	attach_info->is_get_ok = 0;
	attach_info->ok_length = 0;
	attach_info->recive_data = NULL;
	attach_info->start_seq = ntohl(ptcp->seq);
	attach_info->ID_str[0] = 0;
	attach_info->path_of_sender = NULL;
	attach_info->ok_data = (char *)malloc(50000);
	if (attach_info->ok_data == NULL)
		return NULL;
	attach_info->ok_len = 5000;
	memset(attach_info->ok_data, 0, 5000);
	attach_info->prev = attach_tab.head;
	attach_info->next = attach_tab.head->next;
	attach_tab.head->next = attach_info;
	attach_tab.count++;
	if (attach_info->next != NULL)
		attach_info->next->prev = attach_info;
	else
		attach_tab.tail=attach_info;

	//printf("insert_attach_node complete ...\n");
	
//printf("insert attach-%p\n",attach_info);
	return attach_info;
}

int mail_type(char *data)
{
	unsigned short int type = 0;
	char *host_p = NULL;

	if(!strncmp(data,"POST ", 5))
	{
		host_p = strstr(data, "\r\nHost");
		
		if(!strncmp(data, "POST /classic/send.php?", 22))
		{
			type = 0X0115;  //  sina vip
			if(!strncmp(data + 23,"ts=",3)){
				type = 0x0112;}
		} 
		else 
			if(!strncmp(data,"POST /cgi-bin/login.",20))
		{
			type = 0X0101; // sina_pass
		} 
		else 
			if(!strncmp(data,"POST /hd/signin.php",19) || !strncmp(data,"POST /sso/login.",16))
		{
			type = 0x0102;
		}
		else
			if(!strncmp(data,"POST /cgi-bin/cnlogin.",22))
		{
			type = 0X0101;
		}
		else 
			//if(!strncmp(data,"POST /classic/rdMail.php",24))
			if(!strncmp(data,"POST /classic/readmail.php",26))

		//if(!strncmp(data,"POST /classic/send.php",22))
		{
			type = 0x0131;
		}
		else
			if(!strncmp(data,"POST /classic/packatt.php",25))
		{
			type = 0x0133;
		}
		//yanglei
		else
			if(!strncmp(data,"POST /uploadatt.php",19) || !strncmp(data,"POST /classic/uploadatt.php",27))
		{
			type = 0x0142;
		}
		else
			if(!strncmp(data,"POST /webmail/upload.do",23)) 
		{
		       	//type=0x0209;      //21cn_attachment
			type = 0x0261;
		}
		else 
			if (!strncmp(data, "POST /webmail/sendMail.do", 25))
		{
			type = 0x0211;   // 21cn
		} 
		/*else 
			if (!strncmp(data, "POST /maillogin.jsp ",20))
		{
			type = 0x0201;  //21CN_PASS
		} */
		else 
			if (!strncmp(data, "POST /sso/login_js.jsp HTTP/1.1", 31) && strstr(data,"mail.sohu.com")) 
		{
			type = 0x0302;    //sohu vip password
		} 
		else 
			if (!strncmp(data, "POST /login.jsp HTTP/1.1", 24) && strstr(data,"mail.sohu.com")) 
		{
			type = 0x0303;
		} 
		else 
			if (!strncmp(data, "POST /bapp", 10) &&( !strncmp(data + 13, "/mail HTTP/1", 12) || !strncmp(data + 12, "/mail HTTP/1", 12) || !strncmp(data + 14, "/mail HTTP/1", 12) || !strncmp(data + 15, "/mail HTTP/1", 12)) && strstr(data,"mail.sohu.com"))
		{
			type = 0x0311;  //new sohu
		} 
		else 
			if (!strncmp(data, "POST /bapp", 10) && (!strncmp(data + 13, "/mail HTTP/1", 12) || !strncmp(data + 12, "/mail HTTP/1", 12) || !strncmp(data + 14, "/mail HTTP/1", 12) || !strncmp(data + 15, "/mail HTTP/1", 12) )&& strstr(data,"vip.sohu.com"))
		{
			type = 0x0312;
		} 
		else 
			if (!strncmp(data, "POST /bapp", 10) && !strncmp(data + 13, "/mail/att HTTP",14) || !strncmp(data + 12, "/mail/att HTTP", 14) && strstr(data,"mail.sohu.com"))
		{
			type = 0x0341;      //new sohu delete
		} 
		/*else 
		if (!strncmp(data, "POST /bapp", 10) && (!strncmp(data + 13, "/mail/att/flash?xid=", 20) || !strncmp(data + 12, "/mail/att/flash?xid=", 20) || !strncmp(data + 14, "/mail/att/flash?xid=", 20) || !strncmp(data + 15, "/mail/att/flash?xid=", 20)) && strstr(data,".sohu.com"))
		{
		type = 0x0361;
	} */
		else if(!strncmp(data,"POST /bapp/",11) &&strstr(data,"/mail/att?X-Progress-ID"))//!strncmp(data,"POST /bapp/128/mail/att?X-Progress-ID",37) 
                {
                        type=0x0361;
                }

		else 
			if (!strncmp(data, "POST /bapp", 10) && (!strncmp(data + 13, "/mail/att/flash?", 16) || !strncmp(data + 12, "/mail/att/flash?", 16) || !strncmp(data + 14, "/mail/att/flash?", 16) || !strncmp(data + 15, "/mail/att/flash?", 16)) && strstr(data,".sohu.com"))
		{
			type = 0x0361;
		}
		else 
			if (!strncmp(data, "POST /bapp", 10) && (!strncmp(data + 13, "/mail/att/resumeUpload?xid", 25) || !strncmp(data + 12, "/mail/att/resumeUpload?xid", 25) || !strncmp(data + 14, "/mail/att/resumeUpload?xid", 25) || !strncmp(data + 15, "/mail/att/resumeUpload?xid", 25)) && strstr(data,"mail.sohu.com"))
		{  //new sohu vip
			type = 0x0362;
		} 
		else 
			if (!strncmp(data,"POST /a/s?sid=",14) && !strncmp(data+46,"&func=mbox:readMessage",22)&& memfind(host_p,"188.com",50))
		{
			type = 0x0E31;
		} 
		else 
		if ((!strncmp(data, "POST /a/s?sid=", 14) || !strncmp(data, "POST /js3/s?sid=", 16) || !strncmp(data, "POST /js4/s?sid=", 16)) && !strstr(data, "mail.yeah.net"))
		{
			if (strstr(data, "&action=deliver") && memfind(data, "&func=mbox:compose", 100) != NULL)
				type = 0x0411;  //163
			/*else
			if (memfind(data, "&func=global:sequential", 100) != NULL)
				type = 0x0411;  //163*/
			else
			if (memfind(data, "&func=mbox:replyMessage", 100) != NULL)
				type = 0x0411;  //163
			else
			if (strstr(data, "&func=upload:deleteTasks") != NULL)
				type = 0x0441;
			/*else
			if (memfind(data, "&func=global:sequential", 100) != NULL)
			type = 0x0421;*/
			else
			if (memfind(data, "&func=mbox:readMessage", 100) != NULL)
				type = 0x0422;
			else
			if (strstr(data, "&func=mbox:listMessage") != NULL)
				return 0;
		}
		else 
		if (!strncmp(data, "POST /js5/s?sid=", 16) && !strstr(data, "mail.yeah.net"))
		{
			if (strstr(data, "&action=deliver") && memfind(data, "&func=mbox:compose", 100) != NULL)
				type = 0x0411;  //163 V5.0
			else
			if (memfind(data, "&func=mbox:replyMessage", 100) != NULL)
				type = 0x0411;  //163 V5.0
			else
			if (strstr(data, "&func=upload:deleteTasks") != NULL)
				type = 0x0441;
			else
			if (memfind(data, "&func=mbox:readMessage", 100) != NULL)
				type = 0x0426;
			else
			if (strstr(data, "&func=mbox:listMessage") != NULL)
				return 0;
		}
		else
			if(!strncmp(data, "POST /js4/s?sid=", 16) && strstr(data, "mail.yeah.net") && memfind(data, "&func=mbox:readMessage", 100) != NULL)
		{
			type = 0x0821;  // yeah head
		}
		else
			if(!strncmp(data, "POST /js5/s?sid=", 16) && strstr(data, "mail.yeah.net") && memfind(data, "&func=mbox:readMessage", 100) != NULL)
		{
			type = 0x0823;  // yeah head
		}
		else 
			if (!strncmp(data, "POST /CheckUser.jsp HTTP/1.1", 28))
		{
			type = 0x0401;   //hao123 163 password
		}
		else if(!strncmp(data, "POST /login.jsp", 14) || !strncmp(data, "POST /logins.jsp", 15) || ((!strncmp(data, "POST /entry/coremail/fcg/ntesdoor2?", 35) || !strncmp(data, "POST /coremail/fcg/ntesdoor2?", 29)) && strstr(data,"funcid=loginone&")) || (!strncmp(data, "POST /entry/cgi/ntesdoor?", 25) && strstr(data,"funcid=loginone&") && strstr(data,"mail126")))
		{
			type = 0x0401;

			/* 新华网论坛的登录包 */
			if (strncmp(data, "POST /login.jsp HTTP/1.1\r\nHost: forum.home.news.cn\r\n", 52) == 0)
			{
				type = 0x0;
			}
		} 
		else 
			if (!strncmp(data, "POST /coremail/cgi/attachfapps?", 31)) 
		{
			type = 0x0412;   //163 vip 淡�???
		} 
		else
			if (!strncmp(data, "POST /a/p/upload.html?", 22)) 
		{
			type = 0x0461;
		} 
		else 
			if (!strncmp(data, "POST /a/s?func=upload:data&sid=", 31)) 
		{
			type = 0x0462;
		} 
		else 
		if (!strncmp(data, "POST /a/j/flashUpload.jsp?", 26) || !strncmp(data, "POST /js3/compose/upload.jsp?sid=", 33) || !strncmp(data, "POST /js4/compose/upload.jsp?sid=", 33) || (!strncmp(data, "POST /upxmail/upload?sid=", 25) /*&& !strstr(data,"Mail-Upload-endip:") && !strstr(data,"Mail-Upload-offset:")*/))
		{//printf("\n----------------------\n");
			type = 0x0463;
		} 
		else 
			if (!strncmp(data, "POST /mail/SendMessageLight.aspx?", 33))
		{ 
			type = 0x0511;  //hotmail
		} 
		else if(!strncmp(data, "POST /ppsecure/post.srf",23 ))
		{
			type = 0x0501;
		}
		else 
			if (!strncmp(data, "POST /mail/mail.fpp?cnmn=Microsoft.Msn.Hotmail.Ui.Fpp.MailBox.GetInboxData", 74) /*|| !strncmp(data, "POST /mail/mail.fpp?cnmn=Microsoft.Msn.Hotmail.Ui.Fpp.MailBox.PrefetchMessages", 78)*/)
		{
			type = 0x0521;
		} 
		else 
			//if (!strncmp(data, "POST /mail/AttachmentUploader.aspx?", 35)) 
			if(!strncmp(data, "POST /mail/SilverlightAttachmentUploader.aspx", 45))
		{
			type = 0x0561;
		} 
		else 
			//if (!strncmp(data, "POST /mail/SendPhotoHandler.aspx?", 33))
			if (!strncmp(data, "POST /richupload.ashx/", 22))
		{
			type = 0x0562;
		} 
		else 
			if (!strncmp(data, "POST /mail/mail.fpp?cnmn=Microsoft.Msn.Hotmail.Ui.Fpp.MailBox.GetSendPhotoUpload", 80)) 
		{
			type = 0x0563;
		}
		else 
			if (!strncmp(data, "POST /mail/AttachmentUploader.aspx?", 35)) 
		{
			type = 0x0565;
		}
		else
			if (!strncmp(data, "POST /mail/mail.fpp?cnmn=Microsoft.Msn.Hotmail.Ui.Fpp.MailBox.DeleteUploadedAtta", 80)) 
		{
			type = 0x0541; //hotmail delete
		}
		else if(!strncmp(data, "POST /config/login", 18))
		{
			type = 0x0601;
		} 
		else 
			//if (!strncmp(data, "POST /ws/mail/",14)&&(!strncmp(data+16,"/soap?m=SendMessage",19)||!strncmp(data+18,"/soap?m=SendMessage",19))) 
			if (!strncmp(data, "POST /ws/mail/",14)&&strstr(data,"&m=SendMessage"))
		{
			if (strstr(data, "\r\nSOAPAction: urn:yahoo:ymws#SaveMessage\r\n") != NULL) 
			{
				printf("########yahoo save message##########\n");
				return 0;
			}
			type = 0x0611;  //yahoo
		} 
		else 
			if (!strncmp(data, "POST /ws/mail/",14)&&(!strncmp(data+16,"/soap?m=BatchExecute",20)||!strncmp(data+18,"/soap?m=BatchExecute",20))) 
		{
			if (strstr(data, "\r\nSOAPAction: urn:yahoo:ymws#SaveMessage\r\n") != NULL) 
			{
				printf("########yahoo save message##########\n");
				return 0;
			}
			type = 0x0611;  //yahoo
		} 
		/*else 
			if (!strncmp(data+28, "/ya/upload?resulturl=http", 25)||!strncmp(data+5,"/ya/upload?resulturl=http",25)||!strncmp(data+29,"/ya/upload?resulturl=http",25)) 
		{
			type = 0x0661; //original set.
			//type=0x0609; //new setting by yu.
		} */
		else 
			if (!strncmp(data, "POST /mc/compose?&",18) && (strstr(data, "&clean&.jsrand=") || strstr(data, "&clean&hash=")))
		{
		    //if(memfind(data,"&clean&",50))
            //type=0x0615;
			char *p1;
			char id[10];
			strncpy(id,data+24,9);
			if ((p1=strstr(data+50,"&.rand="))&&!strncmp(p1+7,id,9)) 
			{
				return 0;
			}
			else 
			{
				type = 0x0615;
			}
		} 
		else 
			if ((!strncmp(data, "POST /cn.",9) || !strncmp(data, "POST /hk.",9) || !strncmp(data,"POST /us.",9)) && strstr(data,".mail.yahoo.com/ya/upload"))
		{
            		//type = 0x0671; old
			type = 0x0672; //a new one
		}
		else
			if(!strncmp(data, "POST /ws/mail/v2.0/jsonrpc?appid=YahooMailNeo&m=GetDisplayMessage",65) && strstr(data,"&wssid="))
		{
			type = 0x0635;
		}
		else 
			if (!strncmp(data, "POST /cgi/ldmmapp?", 18))
		{
			type = 0x0711; // tom 
		} 
		else 
			if (!strncmp(data, "POST /cgi-bin/attachfapp ", 25))
		{
			type = 0x0761;
		} 
		else 
			if (!strncmp(data, "POST /cgi/login HTTP/1.1", 24) && (host_p != NULL) && (memfind(host_p, "tom.com", 50) != NULL || memfind(host_p, "163.net", 50) != NULL)) 
		{
			type = 0x0701;
		} 
		else 
			if (!strncmp(data, "POST /cgi/163/login_pro.cgi", 27)) 
		{
			type = 0x0702;
		} 
		else 
		if ((!strncmp(data, "POST /js3/s?sid=", 16) || !strncmp(data, "POST /js4/s?sid=", 16) || !strncmp(data, "POST /js5/s?sid=", 16)) && strstr(data, "&func=mbox:compose") && strstr(data, "mail.yeah.net") && strstr(data, "&action=deliver"))
		{
			type = 0x0411; //yeah send mail
		} 
		else 
			if ((!strncmp(data, "POST /login.jsp?type=", 21) || (!strncmp(data, "POST /entry/cgi/ntesdoor?", 25)&&strstr(data,"funcid=loginone&"))) && strstr(data,"mailyeah")) 
		{
			type = 0x0801;
		} 
		else 
			if (!strncmp(data, "POST /jy3/s?sid=", 16)) 
		{
			if (strstr(data, "&func=upload:deleteTasks ") != NULL)
				type = 0x0841;
		} 
		else 
			if (!strncmp(data, "POST /jy3/compose/flashUpload.jsp?", 34) || (!strncmp(data, "POST /upxmail/upload?sid=", 25) && !strstr(data,"Mail-Upload-offset: "))) 
		{
			type = 0x0861;
		} 
		else 
			if (!strncmp(data, "POST /jy3/s?func=upload:data&sid=", 33)) 
		{
			type = 0x0862;
		} 
		else 
			if (!strncmp(data, "POST /jy3/compose/uploadDel.jsp?", 32)) 
		{
			type = 28;
		} 
		else 
			if (!strncmp(data, "POST /user/?q=compose.do", 24)&&strstr(data, "eyou.com")) 
		{
			type = 0x0911; //eyou
		} 
		else 
			if ((!strncmp(data, "POST /user/?q=login.do HTTP/1.1",31))||
						   (!strncmp(data, "POST /?q=login.do HTTP/1.1",26)) && strstr(data, "eyou.com")) 
		{
			type = 0x0901;
		} 
		else 
			if (!strncmp(data, "POST /user/?q=compose.upload.do", 31)&&strstr(data, "eyou.com")) 
		{
			return 0x0961;
		} 
		else //mail
			if ((!strncmp(data, "POST /login.html HTTP/1.1",25)) && strstr(data, "mail.com")) //login
		{
			type = 0x1001;
		} 
		else 
			if ((!strncmp(data, "POST /callgate-",15)) && strstr(data, "/mail/store?") && strstr(data, "mail.com")) 
		{
			type = 0x1011;
		} 
		else 
			if ((!strncmp(data, "POST /callgate-",15)) && strstr(data, "/attachment/upload?") && strstr(data, "mail.com")) 
		{
			type = 0x1061;
		} 
		else 
			if ((!strncmp(data, "POST /callgate-",15)) && strstr(data, "/mail/get?") && strstr(data, "mail.com")) 
		{
			type = 0x1031;
		} 
		else 
			if (!strncmp(data, "POST /attach?usr=", 17)) 
		{
			type = 0x0A01;     //263 content
		} 
		else 
			if (!strncmp(data, "POST /xmweb HTTP/", 17)) 
		{
			type = 0x0A02;  //263 Pass
		}
		else
			if ((!strncmp(data, "POST /cgi-bin/login?sid=", 24) || !strncmp(data, "POST /cgi-bin/login HTTP", 24)) && strstr(data,"mail.qq.com") && !strstr(data,"Android") && !strstr(data,"iPhone"))//过滤掉了手机数据
		{
			type = 0x0B02;
		}
		else 
			if (!strncmp(data, "POST /cgi-bin/compose_send_beta?sid=", 36) && !strstr(data,"\r\nHost: w"))//过滤掉了手机数据
		{
			type = 0x0B11;   //qq
		} 
		else 
			if (!strncmp(data, "POST /cgi-bin/upload",20) && !strstr(data,"\r\nHost: w"))//过滤掉了手机数据
		{
			//printf("type = 0x0B61\n");
			type = 0x0B61;
		} 
		else 
			if (!strncmp(data, "POST /cgi-bin/groupmail_send?sid=", 33) && !strstr(data,"\r\nHost: w"))//过滤掉了手机数据
		{
			type = 0x0B12;
		} 
		else 
			if (!strncmp(data, "POST /bapp/", 11) && strstr(data, "/mail HTTP/1.1") && strstr(data, "mail.sogou.com")) 
		{
			type = 0x0C11;   //old sohu and sogou
		} 
		else 
			if (!strncmp(data, "POST /bapp/", 11) && 
		(strstr(data, "/mail/att/flash?xid=") || strstr(data , "/mail/att?") )&& strstr(data, "mail.sogou.com")) 
		{
			type = 0x0C61;     //sogou and old vip sohu attach
		} 
		else 
			if (!strncmp(data, "POST /servlet/UploadAttachmentsServlet?", 39)) 
		{
			type = 0x0C62;     //old sohu attach
		}  
		else 
			if (!strncmp(data, "POST /cgi/login HTTP/1.1", 24)||
			    (!strncmp(data, "POST /login.jsp?type=", 21)&&strstr(data,"&url=http://entry.mail.126.com/")) ||
			    (!strncmp(data, "POST /cgi/ntesdoor?", 19)&&strstr(data,"&funcid=loginone")&&strstr(data,"Host: entry.mail.126.com")))
		{
			type = 0x0D01;    //126 login from hao126
		} 
		else 
			if (!strncmp(data, "POST /servlet/coremail/login?language", 37)) 
		{
			type = 0x0E01;    //188 login from hao126
		}
		else
			if (!strncmp(data, "POST /ServiceLoginAuth", 22))
		{
			type = 0x0F01;
		}
		else
			if (!strncmp(data, "POST /mail/?ui=", 15) && strstr(data, "&rid="))
		{
			if (strstr(data, "&search=inbox"))
			{
				type = 0x0F24;
			}
			else if(!strstr(data, "&search=inbox"))
			{
				type = 0x0F12;
			}
		}
		else
			if(!strncmp(data , "POST /mail/?ui=", 15) && strstr(data, "&attid="))
		{
			type = 0x0F13;
		}
		else
			if(!strncmp(data, "POST /mail/h/", 13) && strstr(data, "&cs=c"))
		{
			type = 0x0F14;
		}
		else
			if(strstr(data, "/aol-6/en-us/common/rpc/RPC.aspx?") && strstr(data, "&transport=xmlhttp&") && strstr(data, "&a=SendMessage&") && strstr(data, "aol.com"))
		{
			type = 0x1111;
		}
		else
			if(strstr(data, "/aol-6/en-us/common/rpc/RPC.aspx?") && strstr(data, "&transport=iframe&") && strstr(data, "&a=SendMessage&") && strstr(data, "aol.com"))
		{
			type = 0x1161;
		}
		else
			if(strstr(data, "/aol-6/en-us/common/rpc/RPC.aspx?") && strstr(data, "&transport=xmlhttp&") && strstr(data, "&a=GetMessage&") && strstr(data, "aol.com"))
		{
			type = 0x1131;
		}
		
		else 
			if (strstr(data, "POST /smsmw/sms?func=sms:sendSms&sid=") )
		{
			//printf("139 send message\n");
			type = 0x1381; //139 send message
		} 
		
		
		else 
			if (strstr(data, "POST /c/s?func=mbox:readMessage&sid=") ||strstr(data, "POST /RmWeb/mail?func=mbox:readMessage&comefrom="))
		{
			//printf("139 read mail/ message\n");
			type = 0x1322; //139 read message
		} 
		else 
			if(strstr(data, "POST /s?func=mbox:listMessages&sid="))
		{
			type = 0x1323;//139 read message
		}
		else 
			if (strstr(data, "POST /c/s?func=mbox:compose&sid=") || strstr(data, "POST /RmWeb/mail?func=mbox:compose&comefrom=") )
		{
			//printf("139 send mail\n");
			type = 0x1311; //139 send mail 
		} 

		else 
			if (strstr(data, "POST /RmWeb/mail?func=attach:upload&sid=") )
		{
			//printf("139 upload attachment\n");
			type = 0x1361; //139 upload attachment
		} 
		
//
		
//
		else if(!strncmp(data, "POST /accounts/login.do", 23) || !strncmp(data, "POST /accounts/srp.do", 21))
		{
			type = 0x1201;
		}
		else 
			if (!strncmp(data, "POST /Mail-bin/start_mailplus4/simplehtml HTTP/1.1", 50))
		{
			type = 0x1211;
		}
		else 
			if (!strncmp(data, "POST /Mail-bin/attach_mailplus.frame3.cgi?", 42))
		{
			type = 0x1261;
		} 
		else if(!strncmp(data,"POST /Login/Login.ashx HTTP/1.1",31))
		{
printf("139 login -----------\n");
			type=0x1312;
		}

		//手机webmail
		else if(IS_MOVE_WEBMAIL)
		{
			if ((!strncmp(data, "POST /m/s?sid=", 14) || !strncmp(data, "POST /i/s?sid=", 14)) && !strstr(data, "mail.yeah.net"))
			{
				if (memfind(data, "&func=mbox:compose&type=", 100) != NULL)
					type = 0x8111;
				else
				if (memfind(data, "&func=mbox:readMessage", 100) != NULL)
					type = 0x8122;
				else
				if (strstr(data, "&func=mbox:listMessage") != NULL)
					return 0;
			}
			else
				if ((!strncmp(data, "POST /cgi-bin/login?sid=", 24) || !strncmp(data, "POST /cgi-bin/login HTTP", 24)) && strstr(data,"mail.qq.com") && (strstr(data,"Android") || strstr(data,"iPhone")))
			{
				type = 0x8202;
			}
			else 
				if ((!strncmp(data, "POST /cgi-bin/cgi_redirect HTTP", 31) || (!strncmp(data, "POST /cgi-bin/compose_send?sid=", 31) && !strstr(data,"boundary=----"))) && strstr(data,"\r\nHost: w"))
			{
				type = 0x8211;
			} 
			else 
				if ((!strncmp(data, "POST /cgi-bin/compose_send?sid=", 31) && strstr(data,"boundary=----") || !strncmp(data,"POST /cgi-bin/upload?sid=",25)) && strstr(data,"\r\nHost: w"))
			{
				type = 0x8261;
			}
		}
	} 
	else 
		if (!strncmp(data, "GET ", 4)) 
	{
		host_p = strstr(data, "\r\nHost:");

		if (!strncmp(data, "GET /servlet/UploadAttachmentsServlet?index", 43)) 
		{
			type = 0x0C41;   //old sohu delete
		} 
		else 
			if (!strncmp(data, "GET /bapp", 9) && !strncmp(data + 12, "/mail/att/resumeUpload?xid=", 27) || !strncmp(data + 11, "/mail/att/resumeUpload?xid=", 27))
		{
			type = 0x0342;   //new sohu vip delete
		} 
		else 
			if (!strncmp(data, "GET /sso/login.jsp?userid=", 26)) 
		{
			type = 0x0301;     //sohu password
		} 
		else
			if(!strncmp(data,"GET /bapp",9) && (!strncmp(data + 12, "/download/",10) || !strncmp(data + 11, "/download/",10) || !strncmp(data + 13, "/download/",10) || !strncmp(data + 14, "/download/",10)) && strstr(data,".sohu.com"))
		{
			type = 0x0333; //sohu attach download
		}
		else 
			if (!strncmp(data, "GET /classic/getMailbody.php?",29))
		{
			type = 0x0132;
		}
		else 
			if (!strncmp(data, "GET /classic/rdMail.php?",24))
		{
			//yanglei
			type = 0x0141;
			if(!strncmp(data,"GET /classic/rdMail.php?cb=",27))
			{
				//type = 0x0131;//cn revice
				type = 0x0123;
			}
		}
		else
			if (!strncmp(data,"GET /classic/base_download_att.php",34) && strstr(data+100, "Accept: */*") == NULL)
		{
			type = 0x0134;
		}
		else 
			if (!strncmp(data, "GET /classic/readmail.php",25))
		{
			type = 0x0131;
		}
		else 
			if (!strncmp(data, "GET /mc/showMessage?sMid=",25))
		{
			type = 0x0631; //yahoo.com.cn yahoo.cn
		}
		/*else 
			if (!strncmp(data, "GET /ws/mail/v2.0/formrpc?m=GetDisplayMessage",45))
		{
			type = 0x0635;       //yahoo.com
		}*/
		else
			if((!strncmp(data,"GET /cn.",8) || !strncmp(data,"GET /hk.",8)) && strstr(data,".mail.yahoo.com/ya/securedownload?"))
		{
			type = 0x0636;
		}
		else
			if(!strncmp(data,"GET /us.",8) && !strncmp(data+13,".mail.yahoo.com/ya/securedownload?",34))
		{
			type = 0x0637;
		}
		else 
			if (!strncmp(data, "GET /freeinterface/maillogin.jsp?",20))
		{
			type = 0x0201;  //21CN_PASS
		} 
		else 
			if (!strncmp(data, "GET /webmail/readMail.do?",25))
		{
			type = 0x0231;
		} 
		else
			if (!strncmp(data, "GET /webmail/getAttachment.do?messageid=", 40))
		{
			type = 0x0264;
		} 
		else
			if (!strncmp(data,"GET /webmail/getAttachment.do?",30))
		{
			type = 0x0232;
		}
		else 
			if (!strncmp(data, "GET /a/j/dm3/readhtml.jsp?",26) && memfind(host_p, "188.com", 50) != NULL)
		{
			type = 0x0E41;        //188
		}
		else
		if ((!strncmp(data, "GET /js3/read/readhtml.jsp?ssid=", 32) || !strncmp(data, "GET /js4/read/readhtml.jsp?ssid=", 32) || !strncmp(data, "GET /a/j/dm3/readhtml.jsp?ssid=", 31)) && !strstr(data, "mail.yeah.net"))
		{
			type = 0x0423; //126,163 recv mail content
		} 
		else
		if (!strncmp(data, "GET /js5/read/readhtml.jsp?ssid=", 32) && !strstr(data, "mail.yeah.net"))
		{
			type = 0x0426; //126,163 V5.0 recv mail content
		} 
		else 
		if (!strncmp(data, "GET /jyen/read/read.jsp?", 24))
		{
			type = 0x0424;   //0x0424 and 0x0425 are for 163 vip english editon
		} 
		else 
		if (!strncmp(data, "GET /jyen/read/viewMailHTML.jsp?ssid=", 37))
		{
			type = 0x0425;   //0x0424 and 0x0425 are for 163 vip english editon
		}
		else 
		if (!strncmp(data, "GET /js3/down/", 14) && strstr(data, "&mode=download&l=read&action=download_attach"))
		{ // 163 down attach
			//type = 0x0426;
			type = 0x0464;
		}
		else
		if ((!strncmp(data, "GET /js4/read/readdata.jsp?sid=", 31) || !strncmp(data, "GET /js3/read/readdata.jsp?sid=", 31) || !strncmp(data, "GET /js5/read/readdata.jsp?sid=", 31)) && strstr(data,"&action=download_attach") && (strstr(data, "mail.163.com") || strstr(data, "mail.126.com")))
		{ // 163 down attach
			type = 0x0464;//printf("\n                  jiiiiiiiiiiiiiiiiii\n");
			//type = 0x0426;
		}
		else 
		if (!strncmp(data, "GET /coremail/fcg/ldmsapp?funcid=readlett", 41)) 
		{
			type = 0x0721;
		} 
		else
		if (!strncmp(data, "GET /coremail/fcg/ldmsapp/", 26) && strstr(data, "mail.tom.com") && strstr(data, "&download="))
		{
			type = 0x0764;
		} 
		else
			if (!strncmp(data, "GET /att/GetAttachment.aspx?", 28)/* && strstr(data, "hotmail.com")*/) // hotmail down attach
		{
			type = 0x0564;
		} 
		else 
		//if (!strncmp(data, "GET /jy3/read/read.jsp?", 23))
			if (!strncmp(data, "GET /js4/read/readhtml.jsp?ssid=", 32) && strstr(data, "mail.yeah.net"))
		{
			type = 0x0822;
		} 
		else 
			if (!strncmp(data, "GET /js5/read/readhtml.jsp?ssid=", 32) && strstr(data, "mail.yeah.net"))
		{
			type = 0x0823;
		} 
		else //(data, "GET /js4/read/readdata.jsp?sid=", 31)
			if ((!strncmp(data, "GET /js4/read/readdata.jsp?sid=", 31) || !strncmp(data, "GET /js5/read/readdata.jsp?sid=", 31)) && strstr(data, "&mode=download&l=read&action=download_attach") && strstr(data, "mail.yeah.net")) //yeah down attach
		{
			type = 0x0863;
		} 
		else 
			if ((!strncmp(data, "GET /cgi-bin/readmail?folderid=", 31) || !strncmp(data, "GET /cgi-bin/readmail?sid=", 26)) && !strstr(data,"&showreplyhead=") && !strstr(data,"\r\nHost: w"))//过滤掉了手机数据
		{
			type = 0x0B21;
		}
		else
		if ((!strncmp(data,"GET /cgi-bin/download?", 22) || !strncmp(data, "GET /cgi-bin/groupattachment?", 29)) && !strstr(data,"\r\nHost: w"))//过滤掉了手机数据
		{
			type = 0x0B29;
		} 
// 
		else
		if (( host_p && strstr(host_p , ".mail.store.qq.com") && !strstr(host_p ,"Range: bytes")) && !strstr(data,"\r\nHost: w"))//过滤掉了手机数据
		{
			type = 0x0B29;
		} 
// 
		else
		if (strstr(data, "Referer: http://m127.mail.qq.com/cgi-bin/readmail?folderid=1&t=readmail&mailid=") && !strstr(data,"\r\nHost: w"))//过滤掉了手机数据
		{
			type = 0x0B29;
		}
		else 
		if (!strncmp(data, "GET /bapp/", 10) && strstr(data, "/mail/") && strstr(data, "HTTP/1.1") && !strstr(data, "/check?") && strstr(data, "mail.sogou.com") && !strstr(data, "att/progress?X-Progress-ID="))
		{
			type = 0x0C21; //sogou recv mail old
		}
		else 
			if (!strncmp(data, "GET /bapp/", 10) && strstr(data, "/conversation/") && strstr(data, "HTTP/1.1") && !strstr(data, "/check?") && strstr(data, "mail.sogou.com") && !strstr(data, "att/progress?X-Progress-ID=") && strstr(data, "?folder="))
		{
			printf("old sogou recv mail\n");
			type = 0x0C21; //sogou recv mail new
		}
		else
			if (!strncmp(data, "GET /bapp/", 10)&&strstr(data, "/download/")&&strstr(data, "mail.sogou.com")) 
		{
			type = 0x0C63; // sogou down attach
		} 
		else 
			if (!strncmp(data, "GET /xmweb?func=mail",20)) 
		{
			type = 0x0A31;
		} 
		else 
			if (!strncmp(data, "GET /xmweb?sid=",15))
		{
			type = 0x0A32;       //263 receive up
		} 
		else 
			if (!strncmp(data, "GET /user/?q=compose", 20)&&strstr(data, "action=readmail")&&strstr(data, "eyou.com"))
		{
			type = 0x0931;       //eyou
		} 
		else
			if(!strncmp(data, "GET /public/?q=compose.output", 29)&&strstr(data, "action=mail.attach&")&&strstr(data, "eyou.com"))
		{
			type = 0x0932;
		}
		else//mail
			if(!strncmp(data, "GET /callgate-", 14) && strstr(data, "/mail/getBody?") && strstr(data, "mail.com"))
		{
			type = 0x1032;
		}
		else
			if(!strncmp(data, "GET /callgate-", 14) && strstr(data, "/attachment/download") && strstr(data, "mail.com"))
		{
			type = 0x1033;
		}
		else
			if(!strncmp(data,"GET /bapp/",10) && (!strncmp(data+13,"conversation/",13)||!strncmp(data+12,"conversation/",13)) && strstr(data,"mail.sohu.com"))
		{
			type = 0x0331;
		}
		else 
			if (!strncmp(data, "GET /bapp/", 10) && (!strncmp(data + 12, "/mail", 5) || !strncmp(data + 11, "/mail", 5)) && strstr(data, "mail.sohu.com") && !strstr(data, "/dowmload/"))
		{
			//printf("%s\n", data);
			type = 0x0339;
		}
		else 
			if (!strncmp(data, "GET /bapp/", 10) && strstr(data, "/conversation/") && strstr(data, "?folder=") && strstr(data, "mail.sohu.com") && !strstr(data, "/dowmload/"))
		{
			//printf("%s\n", data);
			type = 0x0339;
		}
		else 
			if (!strncmp(data,"GET /bapp/",10) && (!strncmp(data+13,"conversation/",13)||!strncmp(data+12,"conversation/",13)) && strstr(data,"vip.sohu.com"))
		{
			type = 0x0330;
		}
		else
			if ((!strncmp(data, "GET /mail/h/", 12)) && (!(strncmp(data + 24, "/?&v=c&th=", 9)) || !(strncmp(data + 25, "/?&v=c&th=", 9))))
		{

			type = 0x0F22;
		}
		/*else
			if (!strncmp(data, "GET /mail/h/", 12) && (strstr(data, "/?view=att&th=")))
		{
			type = 0x0F31;
		}*/
		else
			if (!strncmp(data, "GET /mail/?ui=", 14) && (strstr(data, "&view=att&th=")))
		{
			type = 0x0F31;
		}
		else
			if (!strncmp(data, "GET /attachment?view=att&th=", 28) || !strncmp(data, "GET /attachment/?view=att&th=", 29))
		{
			type = 0x0F31;
		}
		else
			if (strstr(data, "/aol-6/en-us/mail/get-attachment.aspx?") && strstr(data, "&folder=Inbox&") && strstr(data, "aol.com"))
		{
			type = 0x1132;
		}
		else
			if(!strncmp(data, "GET /hanmailex/ViewMail.daum?", 29))
		{
			type = 0x1221;
		}
		else
			if(!strncmp(data, "GET /Mail-bin/view_submsg3.cgi?", 31))
		{
			type = 0x1231;
		}

		else 
			if (strstr(data, "GET /coremail/s?func=mbox:getMessageData&sid") ||strstr(data, "GET /RmWeb/view.do?func=attach:download&mid="))
		{ 
			//printf("139 download attachment\n");
			type = 0x1364;// 139 download attachment
		}

		//手机webmail
		else if(IS_MOVE_WEBMAIL)
		{
			if ((!strncmp(data, "GET /m/read/readdata.jsp?sid=", 29) || !strncmp(data, "GET /i/read/readdata.jsp?sid=", 29)) && strstr(data,"&action=open_attach") && (strstr(data, "mail.163.com") || strstr(data, "mail.126.com")))
			{
				type = 0x8164;
			}
			else 
				if (!strncmp(data, "GET /cgi-bin/readmail", 21) && strstr(data,"&showreplyhead=") && strstr(data,"\r\nHost: w")) 
			{
				type = 0x8221;
			}
			else
			if ((!strncmp(data,"GET /cgi-bin/download?", 22) || !strncmp(data, "GET /cgi-bin/groupattachment?", 29)) && !strstr(data,"&action=view HTTP") && strstr(data,"\r\nHost: w"))
			{
				type = 0x8229;
			}
		}
		
	}
	
	return type;
}


